
We show that \(\operatorname{\mathbf {\ell }}_p\)  adversarial training with an appropriately selected perturbation radius can serve as a strong baseline against common image corruptions improving both accuracy and calibration on corrupted images.


We analyze the success of \(\operatorname{\mathbf {\ell }}_p\)  adversarial training via a comparison to other natural baselines such as Gaussian data augmentation.
We observe that it can overfit to the perturbation size it has been trained which, however, does not happen for adversarial training.


We introduce an efficient relaxation of adversarial training with learned perceptual image patch similarity (LPIPS) [1]} based on layerwise adversarial perturbations. This new relaxation is at least as effective as previous approaches [2]} but significantly faster to train.


We show that our relaxation approach has cumulative gains with existing data augmentation methods such as AugMix, DeepAugment, ANT, and SIN leading to state-of-the-art performance on common corruptions from CIFAR-10-C and ImageNet-100-C.

